SB2017110501 - SQL injection in Zoho ManageEngine Applications Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017110501

SB2017110501 - SQL injection in Zoho ManageEngine Applications Manager

Published: November 5, 2017 Updated: August 10, 2020

Security Bulletin ID SB2017110501
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) SQL injection (CVE-ID: CVE-2017-16543)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to the viewProps yCanvas field or viewid parameter and execute arbitrary SQL commands via the GraphicalView.do feature of the application in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.


Remediation

Install update from vendor's website.

References